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A SHORTENED STATUTORY PERIOD FOR REPLY IS SET TO EXPIRE 3 MONTH(S) OR THIRTY (30) DAYS, 
WHICHEVER IS LONGER, FROM THE MAILING DATE OF THIS COMMUNICATION. 

- Extensions of time may be available under the provisions of 37 CFR 1 . 1 36(a). in no event, however, may a reply be timely filed 
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earned patent term adjustment. See 37 CFR 1 .704(b). 
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2a)D This action is FINAL. 2b)E3 This action is nonrfinal. 
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DETAILED ACTION 

f 

Response to Amendment 

This office action is in response to amendment filed on 02/02/07. The amendment filed 
on 02/02/07 have been entered and made of record. Therefore, presently pending claims are 1- 
12. 

Response to Arguments 
Applicant's arguments filed 02/02/07 have been fully considered and newly cited prior art 
is applied to the rejection as shown below. The delay in citation of the newly discovered prior 
art is regretted. 

Claim Rejections - 35 USC § 102 
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the 
basis for the rejections under this section made in this Office action: 
A person shall be entitled to a patent unless - 

(e) the invention was described in (1) an application for patent, published under section 122(b), by another filed 
in the United States before the invention by the applicant for patent or (2) a patent granted on an application for 
patent by another filed in the United States before the invention by the applicant for patent, except that an 
international application filed under the treaty defined in section 351(a) shall have the effects for purposes of this 
subsection of an application filed in the United States only if the international application designated the United 
States and was published under Article 21(2) of such treaty in the English language. 

Claims 1-4 and 6 are rejected under 35 U.S.C. 102(e) as being anticipated by 
Nachenberg (6,85 1,057). 

In reference to claims 1 and 6, Nachenberg discloses a virus detection system that 
operates under the control of P-code to detect the presence of a virus in a file having multiple 
entry points (abstract). The method of virus detection includes interpreting code with an 
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interpreter (column 7 lines 35-40); evaluatively writing with said interpreter the result of said 
interpretation (column 7 lines 60-65), wherein the interpreter evaluates the P-code in the P-code 
data file and writes to the data file; and scanning the results of said interpretation for the presence 
of proscribed code and identifying proscribed code in said results (column 7 line 66 to column 8 
line 5), and making results available to a reporter for reporting (column 3 lines 64-67). 

In reference to claim 2, wherein scanning the results of said interpretation for the 
presence of proscribed code further comprises scanning for the presence of code of interest. 
Nachenberg discloses scanning for virus signature and therefore for presence of code of interest 
(column 8 lines 1-2). 

In reference to claim 3, wherein the first scanning step for the presence of code of interest 
further comprises scanning for a file open command or a file modify command (column 7 lines 
45-67). 

In reference to claim 4, Nachenberg discloses a method wherein scanning the results of 
the interpretation for the presence of proscribed code further comprises scanning for the presence 
of code of interest (column 7 lines 45-67 in combination with column 8 lines 1-5). 

Claim Rejections - 35 USC § 103 

The following is a quotation of 35 U.S.C. 103(a) which forms the basis for all 
obviousness rejections set forth in this Office action: 

(a) A patent may not be obtained though the invention is not identically disclosed or described as set forth in 
section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are 
such that the subject matter as a whole would have been obvious at the time the invention was made to a person 
having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the 
manner in which the invention was made. 
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Claims 5, 7-12 are rejected under 35 U.S.C. 103(a) as being unpatentable over 
Nachenberg as applied to claim 1 , and 4 respectfully above, and further in view of Shieh et al 
(5,278,901). 

In reference to claim 7, is rejected as in claim 1 wherein Nachenberg discloses a virus 
detection system that operates under the control of P-code to detect the presence of a virus in a • 
file having multiple entry points (abstract). The system includes an evaluative code interpreter 
(column 7 lines 35-65); a results evaluator (column 7 lines 66-67); a reporter (column 3 lines 64- 
66); whereby, after proscribed code is interpreted by said evaluative code interpreter and results 
generated, those results are reviewed for the presence of proscribed code (column 7 line 66 to 
column 8 line 5), and results reported to said results evaluator, and from said results evaluator to 
a reporter (column 9 lines 47-65). 

However Nachenberg does not expressly disclose a pattern analyzer. 

However Shieh discloses a pattern-oriented system and method of intrusion detection 
(column 4 lines 9-22). The pattern-oriented system is used to detect virus propagation (column 
16 lines 31 to column 17 line 30); therefore the pattern analyzer reviews patterns for the presence 
of proscribed code. 

At the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to add a pattern analyzer for detection for intrusion detection as in the system by 
Shieh in the system of Nachenberg. One of ordinary skill in the art would have been motivated 
to do this because patterns are a simple way of defining deviation from the normal operation of 
the system. 
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In reference to claim 5, Nachenberg does not expressly disclose a system wherein the 
second scanning step for the presence of proscribed code of interest further comprises scanning 
for viral code or viral patterns. * 

However Shieh discloses a pattern-oriented system and method of intrusion detection 
(column 4 lines 9-22). 

At the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to use pattern detection for intrusion detection as in the system by Shieh in the 
system of Jordan. One of ordinary skill in the art would have been motivated to do this because 
patterns are a simple way of defining deviation from the normal operation of the system.. 

In reference to claim 5, Nachenberg discloses a system wherein the step of scanning 
further comprising a first scanning step for the presence of code of interest (column 8 lines 1-5). 

In reference to claim 9, wherein the first scanning step for the presence of code of interest 
further comprises scanning for a file open command or a file modify command (column 7 lines 
46-64). 

In reference to claims 10-12, Nachenberg does not expressly disclose the pattern analyzer 
further reviews said code for the presence of code of interest. 

Shieh discloses the pattern analyzer reviews code for the presence of problems, or code 
of interest (column 4 line 60 to column 5 line 11). 

At the time the invention was made, it would have been obvious to a person of ordinary 
skill in the art to use pattern detection for code of interest as in the system by Shieh in the system 
of Jordan. One of ordinary skill in the art would have been motivated to do this because patterns 
are a simple way of defining deviation from the normal operation of the system. 
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Conclusion 



Any inquiry concerning this communication or earlier communications from the 
examiner should be directed to Paula W. Klimach whose telephone number is (571) 272-3854. 
The examiner can normally be reached on Mon to Thr 9:30 a.m to 5:30 p.m. 

If attempts to reach the examiner by telephone are unsuccessful, the examiner's 
supervisor, Kim Vu can be reached on (571) 272-3859. The fax phone number for the 
organization where this application or proceeding is assigned is 703-872-9306. 

Information regarding the status of an application may be obtained from the Patent 
Application Information Retrieval (PAIR) system. Status information for published applications 
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished 
applications is available through Private PAIR only. For more information about the PAIR 
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR 
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). 
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Thursday, May 03, 2007 
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SUPERVISORY PATENT EXAMINER 
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